Fix bidirectional RF-001A coordination

docs/handoff/TX_AGENT_USAGE.md

@@ -14,17 +14,19 @@ The visible console polls every 5 seconds. A missing rx-node branch or invalid r
 
 ## READY and RED approval
 
-For a fresh valid RF001A_OTA_CAPTURE_002 READY result, the watcher prints the task ID, capture start and expected end. It then asks for:
+RF_HANDOFF_CHANNEL_TEST_001 READY and COMPLETE states are recorded without a RED prompt and never open the production gate.
+
+For a fresh valid RF001A_OTA_CAPTURE_003 READY result, the watcher checks the expected source HEAD, current origin/rx-node commit, common clock and capture window. It then prints the task ID, capture start and expected end and asks for:
 
     AUTHORIZE RF TX
 
 Any other input blocks authorization.
 
-After the exact phrase, the watcher fetches rx-node again. It requires the same result digest, a fresh publication, an active 120-second capture window and at least 10 seconds remaining.
+After the exact phrase, the watcher fetches rx-node again. It requires the same result digest and commit, the expected source HEAD, a fresh publication, an active 120-second capture window, verified common clock and at least 10 seconds remaining.
 
 On success it writes:
 
-    .local\tx_authorizations\RF001A_OTA_TX_002_authorized.json
+    .local\tx_authorizations\RF001A_OTA_TX_003_authorized.json
 
 This record opens the gate for the separately controlled TX executor. The watcher itself does not run hackrf_transfer. The record explicitly says rf_tx_started = false and rf_tx = 0.